Threats tagged 'ghsa-prw3-6895-6mv7'

The UiChemy WordPress plugin, which converts Figma, prompts, and AI builds to Elementor, Gutenberg, and Bricks, is vulnerable to stored cross-site scripting (XSS) in all versions up to and including 5.3.0. The vulnerability arises from insufficient input sanitization and output escaping of a specific URL parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when privileged users interact with the injected content. Exploitation requires a privileged user to click the crafted link, triggering the malicious JavaScript payload.